CVE-2026-16138: Progress ShareFile Storage Zones Controller

High severity, CVSS 8.0. EPSS: 0.8% chance of exploitation in the next 30 days.

In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.

Affected products

• Progress ShareFile Storage Zones Controller: before 5.12.6 (fixed in 5.12.6)

Published 2026-08-17. Last modified 2026-09-02.